The system was hacked in October, 5,000 users were notified, but drugmakers were not told until Nov. 8.

The committee's letter to FDA Commissioner Margaret Hamburg notes that the regulator did not give the industry a heads-up until the late afternoon/early evening of the Veteran's Day three-day weekend and notes that it has concerns the regulator may not have encrypted user passwords, since they asked 5,000 account holders to change them.

The committee's letter requests 11 points of information, including all breach-related documentation and how the agency finally concluded that only 14,000 accounts were touched.

The lawmakers note that the hacked files could include confidential business and medical information, among other items.